CLRGuard - Let's Kick the Door Down. Part One

I really like this tool!  Let me start with that. ;-)

I really appreciate Joe Desimone ( @dez_ ) and EndGame making this available open source.

First, check this DerbyCon 2017 Talk out, it will help you have the necessary background.

The code can be found here:

I've had some time to experiment with this code the last few days.


Lets see what happens when we try to run Mimikatz Inside MSBuild:



BOOM!

I will do another post in the future to go over the internals and some bypasses (I may have found a one or two  :-)  ).

This is a great training tool.  When you find bypasses to this type of defense, it will lead you to better capabilities as an attacker.  I encourage you to dig in and learn from this prototype.  Really good stuff.

This is one of the first tools, I've seen to directly challenge the tactics I am using in .NET to block the capability.

Here is an analogy.

This tool, is NOT an Over-The-Horizon Tool.

Sometimes, we choose to engage attackers Off-Horizon with data collection and analytics.

Sometimes, you have to get in their face a bit, kick in some doors. Write mitigations that directly disrupt the attacks.  Kick in some doors, if you will.


Thats all for today.  Great Work Joe, keep it up.



Cheers,

Casey
@subTee